Bug 680358 (CVE-2011-1020)

Summary:	CVE-2011-1020 kernel: no access restrictions of /proc/pid/* after setuid program exec
Product:	[Other] Security Response	Reporter:	Eugene Teo (Security Response) <eteo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	arozansk, aviro, dhoward, jlieskov, kernel-mgr, kmcmartin, lgoncalv, lwang, pmatouse, tcallawa, vkrizan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-07-29 13:59:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	692038, 692039, 692040, 692041, 692042
Bug Blocks:

Description Eugene Teo (Security Response) 2011-02-25 08:56:08 UTC

Description:
The proc filesystem implementation does not restrict access to the /proc
directory tree of a process after this process performs an exec of a setuid
program, which allows local users to obtain sensitive information or
potentially cause other integrity issues.

References:
https://lkml.org/lkml/2011/2/7/368
http://seclists.org/fulldisclosure/2011/Jan/421
http://openwall.com/lists/oss-security/2011/02/24/18

Acknowledgements:

Red Hat would like to thank Kees Cook for reporting this issue.

Comment 7 Petr Matousek 2011-03-30 09:51:16 UTC

Statement:

Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates.

This has been addressed in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG via RHSA-2012:0007, RHSA-2011:1530 and RHSA-2011:1253 respectively.

Comment 15 errata-xmlrpc 2011-09-12 19:44:53 UTC

This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2011:1253 https://rhn.redhat.com/errata/RHSA-2011-1253.html

Comment 16 errata-xmlrpc 2011-12-06 12:44:19 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:1530 https://rhn.redhat.com/errata/RHSA-2011-1530.html

Comment 17 errata-xmlrpc 2012-01-10 20:05:39 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:0007 https://rhn.redhat.com/errata/RHSA-2012-0007.html

Comment 18 errata-xmlrpc 2012-02-15 00:43:12 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6.1 EUS - Server Only

Via RHSA-2012:0116 https://rhn.redhat.com/errata/RHSA-2012-0116.html